What is the CVSS score of CVE-2026-74008?

CVE-2026-74008 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Phlox Theme Plugin CVE-2026-74008

EUVD-2026-60816 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-08-18 Patchstack

GHSA-942m-q5jr-wqf3

Information Disclosure Shortcodes And Extra Features For Phlox Theme

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated endpoint with no privilege or interaction requirement; only partial confidentiality loss with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:28 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.

AnalysisAI

Sensitive data exposure in the Shortcodes and Extra Features for Phlox Theme WordPress plugin (versions up to and including 2.17.22) allows unauthenticated remote attackers to retrieve sensitive information without credentials via network requests. The flaw is rooted in CWE-201, where the plugin inserts sensitive information into data sent to requestors without enforcing access controls, making it passively collectible by any actor who reaches the affected endpoint. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Fingerprint WordPress site running Phlox plugin

Delivery

Identify publicly accessible plugin endpoint or shortcode page

Exploit

Send unauthenticated HTTP request

Execution

Receive response containing sensitive data

Impact

Extract and collect exposed information

Access

Fingerprint WordPress site running Phlox plugin

Delivery

Identify publicly accessible plugin endpoint or shortcode page

Exploit

Send unauthenticated HTTP request

Execution

Receive response containing sensitive data

Impact

Extract and collect exposed information

Vulnerability AssessmentAI

Exploitation	The target WordPress site must have the Shortcodes and Extra Features for Phlox Theme plugin installed, activated, and running version 2.17.22 or earlier, and the specific plugin functionality triggering the data exposure must be reachable via a publicly accessible URL - such as a front-end page rendering the affected shortcode, or an unauthenticated AJAX or REST endpoint registered by the plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.3 medium score is internally consistent: the attack vector is network (AV:N), complexity is low (AC:L), no privileges or user interaction are required, scope is unchanged, and the only impact is partial confidentiality loss (C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker identifies a WordPress site running the Phlox theme with the vulnerable plugin version via passive scanning or WordPress fingerprinting techniques, then sends a crafted HTTP GET or POST request targeting the plugin's publicly accessible endpoint or shortcode output. The server responds with a page or API payload that inadvertently includes sensitive information - such as internal paths, user metadata, or configuration values - which the attacker harvests directly from the response body. …
Remediation	Update the Shortcodes and Extra Features for Phlox Theme plugin to a version beyond 2.17.22 as soon as one is confirmed available; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-22-sensitive-data-exposure-vulnerability for the exact patched release number, as an independently confirmed fix version is not present in the available data. … Detailed patch versions, workarounds, and compensating controls in full report.